Cisco Small Business Pro SA 520W Administration Manual page 158

Configuring VPN
Advanced Configuration of IPSec VPN
NOTE
STEP 1
STEP 2
STEP 3
Cisco SA 500 Series Security Appliances Administration Guide
The VPN Wizard is the recommended method to create the corresponding IKE and
VPN policies for a VPN tunnel. After the Wizard creates the matching IKE and VPN
policies, you can make changes, as needed. Advanced users can create an IKE
policy from Add but must be sure to use compatible encryption, authentication, and
key-group parameters for the VPN policy.
Click VPN on the menu bar, and then click IPSec > IKE Policies in the navigation
tree. The existing entries appear in the List of IKE Policies table.
The IKE Policies page appears. Any existing policies are listed in the List of IKE
Policies table.
Click Edit to edit an entry.
Other options: Click Add to add an entry. To delete an entry, check the box, and
then click Delete. To select all entries, check the box in the first column of the table
heading.
After you click Add or Edit, the IKE Policy Configuration page appears.
In the General area, enter the following information:
• Policy Name: Enter a unique name for identification and management
purposes.
• Direction/Type: Choose one of the following options:
- Initiator: The security appliance initiates the connection to the remote
end.
- Responder: The security appliance waits passively and responds to
remote IKE requests.
- Both: The security appliance works in either Initiator or Responder mode.
• Exchange Mode: Choose one of the following options:
- Main Mode: Choose this option if you want higher security, but with a
slower connection. Main Mode relies upon two-way key exchanges
between the initiator and the receiver. The key-exchange process slows
down the connection but increases security.
- Aggressive Mode: Choose this option if you want a faster connection,
but with lowered security. In Aggressive Mode there are fewer key
exchanges between the initiator and the receiver. Both sides exchange
information even before there is a secure channel. This feature creates a
faster connection but with less security than Main Mode.
8
158